TW201530344A - Application program access protection method and application program access protection device - Google Patents

Abstract

An application program access protection method comprises the following steps: (A) an application program access protection device having first verification data and a first control specification determining whether an application program to be compared running in an operating system has the first verification data and the first control specification; and (B) when the determination result in step (A) is negative, indicating the application program to be compared is an illegal application program which cannot be authorized, so that the application program access protection device declines the illegal application program to control a controlled device.

Description

Application access protection method and application access protection Device

The present invention relates to an application access protection method, and more particularly to an application access protection method and an application access protection device for preventing an illegal application from controlling a controlled device.

Due to the development and popularity of today's information technology, a variety of convenient applications have emerged. Whether the application user or the provider of the application service cares about whether the provided functional service has sufficient security considerations, if the application is hacked into a malicious program, the user steals during the user's execution. Taking personal information, destroying users' files or operating pictures, etc., will cause the user's personal important information to be leaked or damaged, resulting in irreparable major losses.

Therefore, how to effectively prevent personal data from being stolen or damaged due to the application being spoofed, falsified or implanted with malicious programs becomes an urgent problem to be solved.

Accordingly, it is an object of the present invention to provide an application access protection method that effectively prevents an illegal application from controlling a controlled device.

Thus, the application access protection method of the present invention includes the following Step: (A) an application access protection device having a first authentication data and a first control specification determines whether one of the to-be-matched applications executed in an operating system has the first authentication data and the first control Specification; and (B) in the case where the determination result of the step (A) is negative, indicating that the to-be-matched application is an unauthorized application that cannot be authorized, and the application access protection device does not allow the illegal The application controls a controlled device.

Another object of the present invention is to provide an application access protection device that effectively prevents an illegal application from controlling a controlled device.

Therefore, the application access protection device of the present invention is adapted to determine whether a controlled application is allowed to be executed in an operating system, and the application access protection device includes an authentication data generating unit and a control. The specification generation unit and an authentication unit. The authentication data generating unit is configured to generate a first authentication material. The control specification generating unit is configured to generate a first control specification. The authentication unit is configured to determine whether the to-be-matched application executed in the operating system has the first authentication data and the first control specification, and if the determination result is negative, indicating that the to-be-matched application is unauthorizable An illegal application, and the authentication unit does not allow the illegal application to control the controlled device.

The effect of the present invention is that the application access protection device determines whether the to-be-matched application executed in the operating system has the first authentication data and the first control specification to avoid the absence of the first authentication data. An illegal application of the first control specification controls the controlled device to protect the computer from computer virus infection.

1‧‧‧Application access protection device

11‧‧‧Certificate data generation unit

12‧‧‧Control specification generation unit

13‧‧‧One-time dynamic link program generation unit

14‧‧‧Authorization unit

15‧‧‧Protection unit

16‧‧‧Processing unit

2‧‧‧Controlled device

3‧‧‧ motherboard

31‧‧‧ main memory

311‧‧‧ operating system

32‧‧‧Central Processing Unit

4‧‧‧Storage device

41‧‧‧Protected area

42‧‧‧Hidden Zone

5‧‧‧ legal application

601~608‧‧‧Steps

701~708‧‧‧Steps

Other features and advantages of the present invention will be apparent from the embodiments of the present invention. FIG. 1 is a system block diagram illustrating a preferred embodiment of the application access protection device of the present invention; A flowchart illustrating an authentication process in a preferred embodiment of the application access protection method of the present invention; and FIG. 3 is a flow chart illustrating a re-authentication process in a preferred embodiment of the application access protection method of the present invention .

Referring to FIG. 1, a preferred embodiment of the application access protection device 1 of the present invention is adapted to determine whether a controlled application that is allowed to execute in an operating system 311 is controlled to control a controlled device 2. The application access protection device 1 includes an authentication data generating unit 11, a control specification generating unit 12, a one-time dynamic linking program generating unit 13, an authentication unit 14, a protection unit 15, and a processing unit 16. It is worth mentioning that the application access protection device 1 is implemented in a firmware manner, and the implementation may be a chip that can be mounted on a personal computer, a notebook computer, a tablet computer, a smart phone or a computing system including the storage device and the controlled device, etc., when the chip is mounted on the personal computer, the personal computer includes the application access protection device 1, a motherboard 3, the controlled device 2, and A storage device 4.

The motherboard 3 includes a main memory 31 and a central processing unit 32.

The controlled device 2 can include a secure element (eg, near field communication) Component), at least one of a storage component (eg, a hard drive, a flash memory, or any other form of storage component) and peripheral components (eg, a keyboard, mouse, etc.).

The authentication data generating unit 11 is configured to generate a first authentication data, where the first authentication data includes a one-time authentication algorithm, a one-time key or a one-time authentication code.

The control specification generating unit 12 is configured to generate a first control specification, wherein the first control specification includes at least one of a one-time access specification and a one-time instruction specification. The one-time access specification is an access specification for a legitimate application 5 to transfer the instruction to the processing unit 16, for example, whether the legitimate application 5 can access the secure component, the storage component, and the periphery of the controlled device 2. a specification of the component, whether the legitimate application 5 can change the specification of the access attribute of the file stored in the protected area 41 of the storage device 4, and the legitimate application 5 transmits the command to the processing unit 16 to access the An access specification of the hidden area 42 of one of the storage devices 4, wherein the hidden area 42 cannot be recognized, read, and written by the operating system 311. The one-time instruction specification is a coding specification of the instruction by the processing unit 16 and the legal application 5, for example, defining an instruction code between the legal application 5 and the processing unit 16 (0000 is a read instruction and 0001) Is a write command, etc.). It should be particularly noted that the authentication data generating unit 11 and the control specification generating unit 12 can generate different first authentication materials and first control specifications in cooperation with different legitimate applications.

The one-time dynamic link program generating unit 13 is configured to generate a first one-time dynamic connection according to the first authentication data and the first control specification. And a program in which the first one-time dynamic link program is directly executable by the operating system 311. It should be noted that, in the preferred embodiment, the one-time dynamic link program generating unit 13 includes the first authentication data and the first control code in the first one-time dynamic link program. The legal application 5, the legal application 5 generates the first authentication data and the first control specification according to the first one-time dynamic link program, but the first authentication data and the first control specification may also be respectively The method is provided to the legitimate application 5 without combining the first authentication data and the first control specification into the first one-time dynamic linking program, and is not limited to the manner disclosed in the specification of the present invention.

Since the application access protection device 1 is interposed between the controlled device 2 and the operating system 311 running in the main memory 31, the application to be compared in the operating system 311 needs to be completed and The application accesses the two-way authentication of the authentication unit 14 of the protection device 1 to control the controlled device 2. The operation of the authentication unit 14 will be described in detail below.

The authentication unit 14 is configured to determine whether the to-be-matched application executed in the operating system 311 has the first authentication data and the first control specification. If the determination result is no, it indicates that the to-be-matched application is an illegal application that cannot be authorized, and the authentication unit 14 does not allow the illegal application to control the controlled device 2; if the determination result is yes, the authentication unit Receiving the first authentication data of the to-be-matched application to authenticate the to-be-matched application, and the authenticating unit 14 transmits the first authentication data generated by the authentication data generating unit 11 to the to-be-matched application. For the waiting application to receive the first authentication data to access the application The protection device 1 performs authentication.

After the authentication unit 14 and the to-be-matched application complete mutual authentication with each other, it indicates that the to-be-matched application is the legitimate application 5, and the legitimate application 5 will have an instruction complying with the first control specification. Encrypted with the first authentication data of the legitimate application 5 and transmitted to the processing unit 16, the authentication unit 14 activates the processing unit 16, causing the processing unit 16 to receive the encrypted instruction and decrypt the first authentication data. The instruction, and then the processing unit 16 controls the controlled device 2 in accordance with the decrypted instruction, whereby the legitimate application 5 can control the controlled device 2 via the processing unit 16. In other words, the legitimate application 5 executed in the operating system 311 cannot directly control the controlled device 2 after completing the mutual authentication. The legitimate application 5 must access the processing unit of the protection device 1 through the application. 16 can control the controlled device 2.

In addition, since the application access protection device 1 is interposed between the storage device 4 and the operating system 311 running in the main memory 31, the operating system 311 is read from the protected area 41 of the storage device 4. When the legitimate application 5 is taken, the protected device 1 must be accessed by the application to read the legitimate application 5, and the protection unit 15 of the application access protection device 1 will link the first one-time dynamic link. The program is provided to the legitimate application 5, and the operation of the protection unit 15 will be described in detail below.

The protection unit 15 is configured to: when the operating system 311 reads the legal application 5 and its corresponding one-time one-time dynamic link program from the protection area 41 of the storage device 4, the first one-time dynamic The link program is transmitted to the legitimate application 5 executed in the operating system 311 to take The preset one-time dynamic linking program is replaced, wherein the operating system 311 cannot delete and write the legitimate application 5 in the protected area 41. In the preferred embodiment, the legal application 5 and the preset one-time dynamic link program belong to two separate files, and the operating system 311 can respectively read the legitimate application 5 and the first one-time dynamic The link program, that is, the legitimate application 5 is read first, and then the first one-time dynamic link program that replaces the preset one-time dynamic link program is read. In other embodiments, the legitimate application 5 and the corresponding default one-time dynamic linker belong to the same file, that is, the legitimate application 5 includes an application subroutine and the preset one-time dynamic link program. The operating system 311 cannot read the legal application 5 and the first one-time dynamic link program separately, and the preset one-time dynamic link program has been replaced by the first one-time dynamic link program. And reading the legitimate application 5 including the application subroutine and the first one-time dynamic link program.

When the authentication unit 14 and the to-be-matched application are required to be re-authenticated, the authentication data generating unit 11 is further configured to generate a second authentication data, and the control specification generating unit 12 is further configured to generate a second control specification. Wherein the second authentication profile includes another one-time authentication algorithm, another one-time key or another one-time authentication code, the second control specification including another one-time access specification and another one-time instruction specification At least one. The one-time dynamic link program generating unit 13 is further configured to generate a second one-time dynamic link program according to the second authentication data and the second control specification, and the protection unit 15 transmits the second one-time dynamic link program To the legitimate application 5 executing in the operating system 311, indicating that The legitimate application 5 is converted into a to-be-matched application, and then the authentication unit 14 receives the second authentication data of the to-be-matched application to re-authenticate the to-be-compared application, and the to-be-compared application The second authentication material of the authentication unit 14 is received to re-authenticate the authentication unit 14.

The preferred embodiment of the application access protection method of the present invention and the details of the components of the application access protection device 1 will be described below with reference to the flowcharts of FIGS. 2 to 3, and the steps are summarized into an authentication process and a re-authentication process. .

Referring to FIG. 1 and FIG. 2, the authentication process of the application access protection method of the present invention includes the following steps, wherein the legitimate application 5 is stored in the protection area 41 of the storage device 4, and the operating system 311 cannot The legitimate application 5 inside deletes and writes.

As shown in step 601, when the operating system 311 reads the legitimate application 5 and its corresponding one-time dynamic link program from the protected area 41 of the storage device 4, the authentication data generating unit 11 generates the The first authentication data, the control specification generating unit 12 generates the first control specification, and the one-time dynamic link program generating unit 13 generates the first one-time dynamic link program according to the first authentication data and the first control specification. The protection unit 15 transmits the first one-time dynamic link program to the legitimate application program 5 executed in the work system 311 instead of the preset one-time dynamic link program. In the preferred embodiment, the legal application 5 and the default one-time dynamic link program belong to two separate files, and the operating system 311 can read the legitimate application 5 and the first one. The dynamic link program, that is, the legitimate application 5 is read first, and then the first one-time dynamic link program that replaces the preset one-time dynamic link program is read. In other embodiments, the legitimate application 5 and the corresponding default one-time dynamic linking program belong to the same file, that is, the legitimate application 5 includes the application sub-program and the preset one-time dynamic link program. The operating system 311 cannot read the legal application 5 and the first one-time dynamic link program separately, and the preset one-time dynamic link program has been replaced by the first one-time dynamic link program. And reading the legitimate application 5 including the application subroutine and the first one-time dynamic link program.

As shown in step 602, the legitimate application 5 generates the first authentication data and the first control specification according to the first one-time dynamic link program.

It is worth noting that since the operating system 311 may have a security vulnerability, the legitimate application 5 may be changed to an illegal application during being read into the operating system 311. Therefore, the application executed in the operating system 311 must be authenticated before the controlled device 2 can be controlled, so that the application executed in the operating system 311 will be regarded as a waiting application.

As shown in step 603, the authentication unit 14 determines whether the to-be-matched application executed in the operating system 311 has the first authentication data and the first control specification, and if so, proceeds to step 605; otherwise, proceeds to step 604. .

As shown in step 604, the to-be-matched application cannot be An authorized illegal application, and the application access protection device 1 does not allow the illegal application to control the controlled device 2.

As shown in step 605, the authentication unit 14 receives the first authentication data of the to-be-matched application to authenticate the to-be-matched application, and the to-be-matched application receives the first authentication data of the authentication unit 14. The authentication unit 14 of the application access protection device 1 is authenticated, wherein the first authentication material of the authentication unit 14 is the first authentication data generated by the authentication data generating unit 11.

As shown in step 606, after the authentication unit 14 and the to-be-matched application complete mutual authentication with each other, it indicates that the to-be-matched application is the legitimate application 5, and the legitimate application 5 matches the The instructions of the first control specification are encrypted by the first authentication data of the legitimate application 5 and transmitted to the processing unit 16.

As shown in step 607, the authentication unit 14 activates the processing unit 16 to cause the processing unit 16 to receive the encrypted command and decrypt the command based on the first authentication material.

As shown in step 608, the processing unit 16 controls the controlled device 2 in accordance with the decrypted command so that the legitimate application 5 can control the controlled device 2 via the processing unit 16.

Referring to FIG. 1 and FIG. 3, the usage scenario of the re-authentication process may have multiple modes. For example, it may be designed to start the re-authentication process when the legitimate application 5 wants to transmit an instruction again to control the controlled device 2. Designed to initiate a re-authentication process when the legitimate application 5 transmits a specific command to control the controlled device 2, or is designed to pass each The time interval starts the re-authentication process, and different usage scenarios can be designed according to different usage requirements. The re-authentication process can further prevent the illegal application from controlling the controlled device 2 when the legitimate application 5 is replaced or changed to an illegal application, and the unauthorized application can also change the application. The program accesses the control specification between the protection device 1 and the legitimate application 5. The steps involved in the re-authentication process of the application access protection method of the present invention will be described in detail below.

As shown in step 701, the authentication data generating unit 11 generates the second authentication data, the control specification generating unit 12 generates the second control specification, and the one-time dynamic linking program generating unit 13 according to the second authentication data and the The second control specification generates the second one-time dynamic link program, and the protection unit 15 transmits the second one-time dynamic link program to the legitimate application program 5 executed in the work system 311 instead of the first one. Secondary dynamic linker.

As shown in step 702, the legitimate application 5 generates the second authentication data and the second control specification according to the second one-time dynamic linking program.

It should be particularly noted that since the application executed in the operating system 311 must be re-authenticated to control the controlled device 2, the application executed in the operating system 311 will be regarded as a comparison application again. .

As shown in step 703, the authentication unit 14 determines whether the to-be-matched application executed in the operating system 311 has the second authentication data and the second control specification, and if so, proceeds to step 705; otherwise, Line 704.

As shown in step 704, the to-be-matched application is an illegal application that cannot be authorized, and the application access protection device 1 does not allow the illegal application to control the controlled device 2.

As shown in step 705, the authentication unit 14 receives the second authentication data of the to-be-matched application to authenticate the to-be-matched application, and the to-be-matched application receives the second of the authentication unit 14. The authentication data is authenticated by the authentication unit 14 of the application access protection device 1, wherein the second authentication material of the authentication unit 14 is the second authentication data generated by the authentication data generating unit 11.

As shown in step 706, after the authentication unit 14 and the to-be-matched application complete mutual authentication with each other, it indicates that the to-be-matched application is the legitimate application 5, and the legitimate application 5 will be another The instruction conforming to the second control specification is encrypted by the second authentication material of the legitimate application 5 and transmitted to the processing unit 16.

As shown in step 707, the authentication unit 14 activates the processing unit 16 to cause the processing unit 16 to receive the encrypted additional command and decrypt the other command based on the second authentication material.

As shown in step 708, the processing unit 16 controls the controlled device 2 in accordance with the decrypted another command, whereby the legitimate application 5 can control the controlled device 2 via the processing unit 16.

In summary, the legitimate application 5 is stored in the protected area 41 of the storage device 4, so that neither the operating system 311 nor the malicious program can delete the legitimate application 5 in the protected area 41. And writing, therefore, the legitimate application 5 may only be spoofed, tampered with or implanted with malicious programs when running on the operating system 311, but the first one-time dynamic linking program is transmitted by the protection unit 15 The legitimate application 5 executed in the operating system 311 is such that when the legitimate application 5 running in the operating system 311 is spoofed, tampered with or implanted with a malicious program, the first one-time dynamic linking program is not provided. However, the authentication by the authentication unit 14 cannot be performed. Therefore, only the legitimate application 5 having the first authentication data and the first control specification can control the controlled device 2, so that the object of the present invention can be achieved.

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, that is, the simple equivalent changes and modifications made by the patent application scope and patent specification content of the present invention, All remain within the scope of the invention patent.

1‧‧‧Application access protection device

11‧‧‧Certificate data generation unit

12‧‧‧Control specification generation unit

13‧‧‧One-time dynamic link program generation unit

14‧‧‧Authorization unit

15‧‧‧Protection unit

16‧‧‧Processing unit

2‧‧‧Controlled device

3‧‧‧ motherboard

31‧‧‧ main memory

311‧‧‧ operating system

32‧‧‧Central Processing Unit

4‧‧‧Storage device

41‧‧‧Protected area

42‧‧‧Hidden Zone

5‧‧‧ legal application

Claims (20)

An application access protection method includes the following steps: (A) an application access protection device having a first authentication data and a first control specification determining whether an application to be compared in an operating system is to be compared Having the first authentication data and the first control specification; and (B) if the determination result of the step (A) is negative, indicating that the to-be-compared application is an unauthorized application that cannot be authorized, and The application access protection device does not allow the illegal application to control a controlled device. The application access protection method according to claim 1, further comprising a step (C) before the step (A), when the operating system reads a legitimate application from a protected area of a storage device The application access protection device transmits the first authentication data and the first control specification to a legitimate application executed in the operating system, wherein the operating system cannot delete and write the legitimate application in the protected area In. The application access protection method according to claim 2, wherein in the step (C), the legitimate application includes an application subroutine, a preset authentication data, and a preset control specification, when the operating system is When the legal application is read in the protection area of the storage device, the protection unit transmits the first authentication data and the first control specification to a legitimate application executed in the operating system to replace the preset authentication data and This preset control specification. The application access protection method as claimed in claim 2, wherein the step is In the step (C), when the operating system reads the legal application and its corresponding preset authentication data and a preset control specification from the protected area of the storage device, the protection unit determines the first authentication. The data and the first control specification are transmitted to a legitimate application executing in the operating system. The application access protection method according to claim 2, further comprising a step (D), wherein if the determination result of the step (A) is YES, indicating that the to-be-matched application is the legitimate application And the application access protection device allows the legitimate application to control the controlled device, wherein the step (D) comprises the following sub-steps: (D-1) the application access protection device receives the to-be-matched application The first authentication data is used to authenticate the to-be-matched application, and the to-be-matched application receives the first authentication data of the application access protection device to authenticate the application access protection device; -2) after the application access protection device and the to-be-matched application complete mutual authentication with each other, indicating that the to-be-matched application is the legitimate application, and the legitimate application is based on the first control The specification transmits an instruction to the application access protection device; and (D-3) the application access protection device controls the controlled device according to the instruction, so that the legitimate application can be passed through the application The protection device is accessed and the controlled device is controlled. The application access protection method according to claim 5, wherein in the step (D-2), after the application access protection device and the legitimate application complete mutual authentication with each other, the legitimate application Encrypting the instruction with the first authentication data of the legitimate application and transmitting the instruction to the response Accessing the protection device by the program, and then in the step (D-3), the application access protection device receives the encrypted instruction and decrypts the instruction according to the first authentication data of the application access protection device. And the application access protection device controls the controlled device according to the decrypted instruction, so that the legitimate application can access the protection device via the application to control the controlled device. The application access protection method according to claim 5, after the step (D), further comprising a re-authentication step (E), wherein the step (E) comprises the following sub-steps: (E-1) the application The program access protection device transmits a second authentication data and a second control specification to a legitimate application executed in the operating system, and the legitimate application executed in the operating system is converted into the to-be-compared application. And (E-2) the application access protection device receives the second authentication data of the to-be-matched application to re-authenticate the to-be-matched application, and the to-be-matched application receives the application The program accesses the second authentication material of the protection device to re-authenticate the application access protection device. The application access protection method of claim 5, wherein in the step (A), the first control specification comprises at least one of a one-time access specification and a one-time instruction specification, wherein the first time The access specification is an access specification for the legitimate application to transfer the instruction to the application access protection device, and the one-time instruction specification is that the application access protection device and the legitimate application encode the instruction specification. The application access protection method of claim 8, wherein in the step (A), the one-time access specification of the first control specification includes the legitimate application transmitting the instruction to the processing unit to access An access specification of a hidden area of the storage device, wherein the hidden area cannot be recognized, read, and written by the operating system. The application access protection method of claim 1, wherein in the step (A), the first authentication material comprises a one-time authentication algorithm, a one-time key or a one-time authentication code. An application access protection device is interposed between the controlled device and an operating system, and is adapted to determine whether to allow a controlled application to be executed in the operating system to control a controlled device, the application is stored The protection device includes: an authentication data generating unit for generating a first authentication data; a control specification generating unit for generating a first control specification; and an authentication unit for determining execution in the operating system Whether the application has the first authentication data and the first control specification, and if the determination result is no, it indicates that the to-be-matched application is an illegal application that cannot be authorized, and the authentication unit does not allow the illegal application. The program controls the controlled device. The application access protection device of claim 11, further comprising a protection unit, wherein the protection unit is configured to: when the operating system reads a legitimate application from a protected area of a storage device Certification And the first control specification is transmitted to a legitimate application executing in the operating system, wherein the operating system cannot delete and write to the legitimate application in the protected area. The application access protection device of claim 12, wherein the legitimate application comprises an application subroutine, a preset authentication data, and a preset control specification, when the operating system is from the protected area of the storage device When the legal application is read, the protection unit transmits the first authentication data and the first control specification to a legitimate application executed in the operating system to replace the preset authentication data and the preset control specification. The application access protection device of claim 12, wherein when the operating system reads the legitimate application and the corresponding preset authentication data and a preset control specification from the protected area of the storage device The protection unit transmits the first authentication data and the first control specification to a legitimate application executed in the operating system. The application access protection device of claim 12, further comprising a processing unit, if the determination result of the authentication unit is yes, the authentication unit receives the first authentication data of the to-be-matched application to be compared Authenticating the application, the waiting application receiving the first authentication data of the authentication unit to authenticate the application access protection device, and performing mutual authentication between the authentication unit and the to-be-matched application After that, the application to be compared is the legitimate application, and the authentication unit starts the processing unit, so that the processing unit receives an instruction sent by the legitimate application according to the first control specification, and then the processing unit Controlling the controlled device according to the instruction, thereby making the The legitimate application can control the controlled device via the processing unit. The application access protection device of claim 15, wherein after the authentication unit and the legitimate application complete mutual authentication with each other, the legitimate application encrypts the instruction with the first authentication data of the legitimate application. And transmitting to the processing unit, the processing unit receiving the encrypted instruction and decrypting the instruction according to the first authentication data, and then the processing unit controls the controlled device according to the decrypted instruction, thereby causing the legitimate application The controlled device can be controlled via the processing unit. The application access protection device of claim 15, wherein the authentication data generating unit is further configured to generate a second authentication data, the control specification generating unit is further configured to generate a second control specification, and the protection unit The second authentication data and the second control specification are transmitted to a legitimate application executed in the operating system, and the legitimate application executed in the operating system is converted into the to-be-matched application, and then the authentication unit receives The second authentication data of the application to be compared is used to re-authenticate the to-be-compared application, and the to-be-matched application receives the second authentication data of the authentication unit to re-authenticate the authentication unit. The application access protection device of claim 15, wherein the first control specification comprises at least one of a one-time access specification and a one-time instruction specification, wherein the one-time access specification is the legal application The program transmits the instruction to the access specification of the processing unit, the one-time instruction specification is that the processing unit and the legitimate application program The coding specification of the order. The application access protection device of claim 18, wherein the one-time access specification of the first control specification comprises the legitimate application transmitting the instruction to the processing unit to access a hidden area of the storage device The specification is taken, wherein the hidden area cannot be recognized, read, and written by the operating system. The application access protection device of claim 11, wherein the first authentication material comprises a one-time authentication algorithm, a one-time key or a one-time authentication code.